Second Life and UK data protection

I asked a while back whether the fact that Linden Lab is now charging VAT in the UK means that it is also required to comply with other UK legislation, such as the Data Protection Act (DPA).

A story from the BBC today indicates that Facebook is now being investigated by the Information Commissioner's Office (ICO), looking at privacy issues around the way the service continues to hold personal information about people after they have unsubscribed.

Although Facebook and many other social networks are based outside of the UK, Mr Evans [Senior Data Protection Practice Manager at the ICO] believes that UK law could still apply.

"They are established in the UK for UK legislation to cover their activities."

For the record, I don't have concerns that Linden Lab are abusing personal information. Just interested as to how far a US company is obliged to comply with legislation in the UK.